1. Field of the Invention
The invention relates to a fault-tolerant electromechanical actuating device for converting an electrical actuating signal into a mechanical output actuating value for use in vehicles, having two mutually independent control loops. Each control loop has a controller, an electric motor driven by the controller and providing an actuating value; and a self-locking transmission driven by the motor. A summary transmission driven by the self-locking transmissions superimposes the actuating values of the actuating motors to form a mechanical output actuating value.
2. Description of the Related Art
DE 198 33 460 discloses a fault-tolerant steering actuator having an electronic closed-loop/open-loop control transmission, which generates steering signals for an electric actuating motor. The steering actuator has an electronic closed-loop/open-loop control transmission which is subdivided into two subsystems, each having a step-down transmission which is connected to the output side of an actuating motor and on which output angles are summed in a common step-up transmission. The output shaft of the step-up transmission is led to the steering transmission and is provided with an angle sensor. The torques of the actuating motors are dimensioned in such a way that they can perform the steering task completely on their own in each case, so that a fail-safe characteristic is provided. The motors of the subsystems are each driven by a power output stage which, in turn, receives its enable signal from both process computers. In this case, the enable signal is prioritized by the other process computer in each case not belonging to the subsystem, in order to be able to drive the respective power output stage by means of the intact process computer in the event of a defect in the process computer of this subsystem. In order to be able to detect faults, each process computer additionally has to calculate the control data of the other subsystem in parallel with its own.
If a process computer fails, then the corresponding control loop is taken out of operation. Furthermore, it may be part of the failure pattern for this defective process computer to switch off the other control loop as well, via its prioritized enable signal, and therefore to switch off any actuating function.
Electrical faults in a subsystem in this arrangement can also be transmitted to the other subsystem via the measuring lines.
The object of the invention is to avoid these weaknesses and to increase the fault tolerance of an electromechanical actuating device further, so that the actuating device remains completely serviceable even when a fault occurs.
This object is achieved by the addition of a comparator controller which monitors the functions of the control loops, and interfaces between the controllers and the loops which electrically isolate the loops from each other.
As a result of the advantageous digital communication according to the invention between the controllers, the additional comparator controller also receives the sensor values from these controllers and, by using the input signal which is likewise supplied, monitors the functions of the two controllers. In addition, the control data from the control loops can be exchanged via the digital communication between all the controllers. The preferably optical design of the digital communication achieves stringent isolation of the electrical potentials of the loops.
However, if a control loop fails, the comparator controller then interrupts the controlled section of the faulty channel. The motor of the faulty branch can therefore both be idling and stationary. As a result of the self-locking transmission, the faulty branch always remains at a standstill. The intact branch can continue to fulfil the control task via the summing transmission.
The possibility that the comparator controller fails and stops both circuits is prevented by the technical design of the enabling means. The enabling means or drive of the enabling means is designed in such a way that when one of the two enabling means is opened (that is to say interrupts the control loop), in every case the other enabling means necessarily closes (that is to say enables this control loop). Therefore, even in the event of a defective comparator, the function of the actuating device is ensured. The internal design of the comparator with two relays ensures that the control loop still functions even when part of the enable circuit (one relay) fails.
Other objects and features of the present invention will become apparent from the following detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims. It should be further understood that the drawings are not necessarily drawn to scale and that, unless otherwise indicated, they are merely intended to conceptually illustrate the structures and procedures described herein.